Mozjs52: [Unknown description] (CVE-2026-84133)

CVE-2026-84133 is a site isolation issue in the DOM Push Subscriptions component of Firefox, reported internally and fixed in Firefox 155. Site isolation issues can allow processes to access data they should not, potentially leading to information disclosure or other security risks. This vulnerability was part of a broader set of security fixes announced by Mozilla in their MFSA 2026-82 advisory. The CVSS score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating a high technical severity, but the vendor impact rating for this specific issue is low. The vulnerability affects multiple versions of the mozjs52 package used in various Ubuntu LTS releases. No active exploitation has been reported. The vendor advisory is the authoritative source confirming the fix in Firefox 155.

The vulnerability could allow a site isolation bypass in the DOM Push Subscriptions component, potentially enabling unauthorized access to data or processes that should be isolated. However, the vendor rates the impact of this specific vulnerability as low. The CVSS score suggests a high severity, but the vendor's assessment and lack of known exploits indicate limited practical impact. The vulnerability affects multiple Ubuntu LTS versions through the mozjs52 package. The fix is included in Firefox 155, mitigating the issue.

The vulnerability is fixed in Firefox 155. Users and administrators should upgrade to Firefox 155 or later to remediate this issue. Since this is not a cloud service, manual patching or upgrading is required. No additional mitigation actions are specified or required beyond applying the official update. Monitor the Mozilla Foundation Security Advisory MFSA 2026-82 for further details.